Implementation Guides·Updated 2025-07-01·8 min read

How to Configure DKIM Correctly

Step-by-step guide to setting up DKIM (DomainKeys Identified Mail) for cold email — key generation, DNS records, provider-specific instructions, and verification.

Quick Answer

Generate a DKIM key through your email provider's admin console, add the resulting TXT record to your DNS at the selector subdomain, wait for propagation, and verify at MXToolbox.

How DKIM Works
DKIM for Google Workspace
DKIM for Microsoft 365
The DKIM DNS Record
How to Verify DKIM
Common DKIM Errors

Introduction

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email you send. Receiving servers use the public key in your DNS to verify the signature, proving the email came from you and was not altered in transit.

This guide walks through DKIM configuration for Google Workspace and Microsoft 365, including key generation, DNS record setup, and verification.

Who This Guide Is For

• Anyone configuring DNS authentication for cold email
• People whose emails fail DKIM checks
• Teams setting up email infrastructure on Google Workspace or Microsoft 365

Key Takeaways

1. DKIM keys are generated by your email provider, not created manually
2. The DNS record goes at a selector subdomain (e.g., google._domainkey.yourdomain.com)
3. DKIM proves the email was not altered in transit
4. Both Google Workspace and Microsoft 365 have built-in DKIM key generation
5. Always verify DKIM at MXToolbox after adding the DNS record

How DKIM Works

Your email provider generates a DKIM key pair (private + public)
The private key is kept by your provider and used to sign every outgoing email
The public key is published as a DNS TXT record
When the receiving server gets your email, it looks up the public key
The server verifies the signature matches — proving authenticity and integrity

For a full explanation of how DKIM fits into the authentication picture, see our SPF vs DKIM vs DMARC guide.

DKIM for Google Workspace

Go to admin.google.com > Apps > Google Workspace > Gmail > Authenticate email
Select your domain from the dropdown
Click 'Generate new record'
Choose the DKIM key bit length (2048 is recommended)
Click 'Generate' — Google creates the key and shows you the DNS record
Add the TXT record to your DNS at the selector subdomain (e.g., google._domainkey.yourdomain.com)
Wait 24–48 hours for DNS propagation
Return to the Authenticate email page and click 'Start authentication'

📝 Example

Google Workspace admin showing DKIM key generation with the DNS record values (host name and TXT value).

⚠️ Warning

You must click 'Start authentication' in the admin console after adding the DNS record. The key exists but is not active until you enable it.

DKIM for Microsoft 365

Go to security.microsoft.com > Email & identity > Email authentication > DKIM
Select your domain from the list
Click 'Enable DKIM signatures'
Microsoft generates the keys and adds DNS records automatically in some cases
If manual DNS configuration is needed, add the two CNAME records shown
Wait 24–48 hours for DNS propagation

ℹ️ Info

Microsoft 365 uses CNAME records rather than TXT records for DKIM. The CNAME records point to Microsoft's DKIM keys. This is different from Google Workspace's approach.

The DKIM DNS Record

A DKIM record is a TXT record published at a specific subdomain called the selector. The full record name is: [selector]._domainkey.yourdomain.com

Provider	Record Type	Host/Name	Value Format
Google Workspace	TXT	google._domainkey	v=DKIM1; k=rsa; p=MIGfMA0...
Microsoft 365	CNAME	selector1._domainkey	selector1-[domain]._domainkey.onmicrosoft.com
Microsoft 365	CNAME	selector2._domainkey	selector2-[domain]._domainkey.onmicrosoft.com

💡 Tip

Do not try to generate DKIM keys manually. Always use your email provider's key generation tool. The private key must be managed by the provider.

How to Verify DKIM

Wait 24–48 hours after adding the DNS record
Go to mxtoolbox.com/DKIMLookup.aspx
Enter your domain and the selector (e.g., google)
Verify the DKIM record is found and the public key is valid
Send a test email to mail-tester.com and check the DKIM result
For Google Workspace, verify 'Start authentication' is enabled in the admin console

Common DKIM Errors

Error	Cause	Fix
DKIM record not found	DNS record not added or not propagated	Wait 48h, verify record is saved correctly
Selector mismatch	DNS record at wrong subdomain	Check the selector name from your provider
Key too small	Using 1024-bit key instead of 2048	Regenerate with 2048-bit key
Authentication not started	Google Workspace: did not click Start auth	Go to admin console and enable

Best Practices

✓ Use 2048-bit keys for stronger security
✓ Always use your email provider's key generation tool
✓ Wait for DNS propagation before testing
✓ Verify at MXToolbox and mail-tester.com
✓ Enable DKIM in the admin console (Google and Microsoft require this step)
✓ Check DKIM status monthly to ensure nothing has changed

Mistakes to Avoid

✗ Not clicking 'Start authentication' in Google Workspace
✗ Adding the DNS record at the wrong selector subdomain
✗ Using 1024-bit keys instead of 2048-bit
✗ Trying to generate DKIM keys manually
✗ Not waiting for DNS propagation before testing

Expert Tips

★ DKIM alignment is more reliable than SPF alignment for Gmail deliverability
★ If DKIM fails at mail-tester.com but the record exists at MXToolbox, check the selector name
★ Google Workspace requires you to click 'Start authentication' — the DNS record alone is not enough
★ Use the Inbox Readiness Score to verify DKIM is working alongside SPF and DMARC

DKIM Configuration Checklist

☐ DKIM key generated through email provider admin console
☐ DNS TXT record (or CNAME for Microsoft) added at selector subdomain
☐ 2048-bit key length selected
☐ DNS propagation waited (24–48 hours)
☐ 'Start authentication' enabled (Google Workspace)
☐ DKIM verified at MXToolbox
☐ Test email passes DKIM at mail-tester.com

Summary

DKIM adds a cryptographic signature to your emails that proves they were not altered in transit. Keys are generated by your email provider and published as DNS records at a selector subdomain.

For Google Workspace, generate the key in the admin console, add the TXT record, and click 'Start authentication.' For Microsoft 365, enable DKIM through the Defender portal. Both require DNS propagation time.

Always verify DKIM at MXToolbox and mail-tester.com. DKIM is one part of the three-part authentication system — also configure SPF and DMARC.

Frequently Asked Questions

What is a DKIM selector?

The selector is a subdomain prefix that identifies which DKIM key to use. Google uses 'google' (google._domainkey.yourdomain.com). Microsoft uses 'selector1' and 'selector2'. Your email provider specifies the selector.

Can I have multiple DKIM keys?

Yes. If you use multiple email providers, each can have its own DKIM key at a different selector. For example, google._domainkey for Google and selector1._domainkey for Microsoft.

Why does Google Workspace require me to click 'Start authentication'?

The DNS record publishing and the DKIM signing are separate steps. Publishing the record makes the public key available. Clicking 'Start authentication' tells Google to actually sign your emails with the private key.

How do I know which bit length to choose?

Choose 2048-bit. It is more secure than 1024-bit and is the current industry standard. Most providers default to 2048-bit.